'use strict';

const http = require('http');
const https = require('https');
const http2 = require('http2');
const net = require('net');
const crypto = require('crypto');
// os 模块不引用 — 避免暴露真实主机信息

// ─── 配置 ───────────────────────────────────────────────
const UPSTREAM_HOST = process.env.UPSTREAM_HOST || 'api.anthropic.com';
const LISTEN_PORT = parseInt(process.env.PROXY_PORT || '3456', 10);
const LISTEN_HOST = process.env.PROXY_HOST || '127.0.0.1';
const UPSTREAM_PROXY = process.env.UPSTREAM_PROXY || '';
const CONNECT_TIMEOUT = parseInt(process.env.CONNECT_TIMEOUT || '30000', 10);
const IDLE_TIMEOUT = parseInt(process.env.IDLE_TIMEOUT || '600000', 10);
const TELEMETRY_ENABLED = process.env.TELEMETRY_ENABLED !== 'false'; // 默认开启
const DD_API_KEY = process.env.DD_API_KEY || 'pubbbf48e6d78dae54bceaa4acf463299bf';
const CLI_VERSION = process.env.CLI_VERSION || '2.1.81';
const BUILD_TIME = process.env.BUILD_TIME || '2026-03-20T21:26:18Z';
// 伪装的 Node 版本（CLI 2.1.81 打包的 Node 版本）
const FAKE_NODE_VERSION = process.env.FAKE_NODE_VERSION || 'v22.14.0';

const log = (level, msg, extra = {}) => {
  const entry = { time: new Date().toISOString(), level, msg, ...extra };
  process.stderr.write(JSON.stringify(entry) + '\n');
};

const HEALTH_PATH = '/__health';
const h2Hosts = new Set();
const h2Sessions = new Map();

// ─── 虚拟主机身份生成 ─────────────────────────────────────
// 每个账号基于 seed 生成全局唯一的主机身份，看起来像一台真实的个人开发机
// 匹配 CLI 的 OTEL detectResources: hostDetector + processDetector + serviceInstanceIdDetector
//
// 设计原则：
//   1. 同一账号（seed）永远产出同一台"机器"的特征
//   2. 不同账号的特征互不相同（无共享池、无碰撞）
//   3. 每个字段都像人手动设置的，不是程序生成的

// hostname 构造词表 — 组合后空间 > 100万，基本不碰撞
const HN_PREFIX = ['dev','code','work','build','my','home','lab','eng','hack','prog','desk','box','main','personal','linux'];
const HN_MIDDLE = ['','station','machine','server','node','pc','setup','rig','env','hub'];
const HN_STYLE  = ['dash','dot','bare']; // 连接风格

// 用户名词表 — 真实开发者常用，组合后也是高基数
const UN_FIRST = ['alex','sam','chris','jordan','max','lee','kai','pat','jamie','taylor','morgan','casey','drew','avery','riley','blake','quinn','reese','cameron','skyler','dev','coder','user','admin','ubuntu','runner'];
const UN_SUFFIX = ['','dev','eng','42','_dev','01','x','z','_','99','007'];

function generateHostIdentity(seed) {
  // 确定性哈希工具：同一 seed+suffix 永远返回同一结果
  const h = (suffix) => crypto.createHash('sha256').update(seed + ':' + suffix).digest();

  // ── hostname: 组合生成，如 "alex-devstation", "work-box-7f3a" ──
  const hb = h('hostname');
  const prefix = HN_PREFIX[hb.readUInt8(0) % HN_PREFIX.length];
  const middle = HN_MIDDLE[hb.readUInt8(1) % HN_MIDDLE.length];
  const style  = HN_STYLE[hb.readUInt8(2) % HN_STYLE.length];
  const tail   = hb.slice(3, 5).toString('hex'); // 4 hex chars 保证唯一
  let hostname;
  if (middle) {
    const sep = style === 'dot' ? '.' : style === 'dash' ? '-' : '';
    hostname = `${prefix}${sep}${middle}`;
  } else {
    // 无中间词时必须加 hex 尾缀，避免 hostname 太短（如裸 "my"、"dev"）
    hostname = `${prefix}-${tail}`;
  }
  // 有中间词时 50% 概率加 hex 尾缀（真实场景很多人用 hostname 如 "dev-box-a3f2"）
  if (middle && hb.readUInt8(5) % 2 === 0) hostname += `-${tail}`;

  // ── username: 组合生成，如 "alexdev", "sam42", "chris_dev" ──
  const ub = h('username');
  const first  = UN_FIRST[ub.readUInt8(0) % UN_FIRST.length];
  const suffix = UN_SUFFIX[ub.readUInt8(1) % UN_SUFFIX.length];
  const username = `${first}${suffix}`;

  // ── terminal & shell: 按权重分布（xterm-256color 占大多数） ──
  const termRoll = h('terminal').readUInt8(0) % 100;
  const terminal = termRoll < 60 ? 'xterm-256color' :
                   termRoll < 75 ? 'screen-256color' :
                   termRoll < 88 ? 'tmux-256color' :
                   termRoll < 95 ? 'alacritty' : 'rxvt-unicode-256color';

  const shellRoll = h('shell').readUInt8(0) % 100;
  const shell = shellRoll < 55 ? '/bin/bash' :
                shellRoll < 85 ? '/bin/zsh' :
                shellRoll < 95 ? '/usr/bin/bash' : '/usr/bin/zsh';

  // ── host.id: /etc/machine-id (32 hex chars, Linux 标准) ──
  const machineId = h('machine-id').slice(0, 16).toString('hex');

  // ── PID: 每个 session 随机生成，模拟每次启动新进程 ──
  // 不用 seed 确定性生成，因为真实 CLI 每次启动都是新 PID
  const pid = 1000 + Math.floor(Math.random() * 64000);

  // ── kernel version: 模拟真实 Linux 发行版 ──
  const kb = h('kernel');
  const kernelMajor = 5 + (kb.readUInt8(0) % 2); // 5 or 6
  const kernelMinor = kb.readUInt8(1) % 20;
  const kernelPatch = kb.readUInt8(2) % 200;
  const ubuntuBuild = 50 + (kb.readUInt8(3) % 150);
  const osVersion = `#${ubuntuBuild}-Ubuntu SMP`;

  // ── 可执行文件路径: 按安装方式分布 ──
  const pathRoll = h('execpath').readUInt8(0) % 100;
  const executablePath = pathRoll < 40 ? `/home/${username}/.claude/local/claude` :
                         pathRoll < 70 ? '/usr/local/bin/claude' :
                         pathRoll < 90 ? `/home/${username}/.local/bin/claude` :
                                         '/usr/bin/claude';

  return {
    hostname,
    username,
    terminal,
    shell,
    machineId,
    pid,
    arch: 'x64',
    osType: 'Linux',
    osVersion,
    kernelRelease: `${kernelMajor}.${kernelMinor}.${kernelPatch}-generic`,
    // service.instance.id: 每个 session 唯一（CLI 用 randomUUID）
    serviceInstanceId: crypto.randomUUID(),
    executablePath,
    executableName: 'claude',
    command: 'claude',
    commandArgs: [],
    runtimeName: 'nodejs',
    runtimeVersion: FAKE_NODE_VERSION.replace('v', ''),
    // ripgrep 信息也按 seed 生成，不同账号不一样
    ripgrepVersion: (() => {
      const rv = h('ripgrep');
      const versions = ['14.1.1','14.1.0','14.0.2','13.0.0','13.0.1','14.0.1','14.0.0'];
      return versions[rv.readUInt8(0) % versions.length];
    })(),
    ripgrepPath: (() => {
      const rp = h('rgpath');
      const paths = ['/usr/bin/rg','/usr/local/bin/rg','/home/'+username+'/.cargo/bin/rg','/snap/bin/rg','/usr/bin/rg','/usr/bin/rg'];
      return paths[rp.readUInt8(0) % paths.length];
    })(),
    // MCP server 数量（真实用户 0~6 个，影响启动事件序列）
    mcpServerCount: 1 + (h('mcp').readUInt8(0) % 5), // 1~5
    mcpFailCount: h('mcp').readUInt8(1) % 3,          // 0~2 个失败
  };
}

// ─── 遥测模拟 ────────────────────────────────────────────

// 每个 device_id 的会话状态
const sessionStates = new Map();

function getOrCreateSession(deviceId) {
  if (sessionStates.has(deviceId)) return sessionStates.get(deviceId);
  const hostId = generateHostIdentity(deviceId);
  const state = {
    sessionId: crypto.randomUUID(),
    deviceId,
    hostId,
    startTime: Date.now(),
    requestCount: 0,
    // 追踪 ripgrep 是否已上报
    ripgrepReported: false,
  };
  sessionStates.set(deviceId, state);
  return state;
}

function generateDeviceId(accountSeed) {
  return crypto.createHash('sha256').update(`device:${accountSeed}`).digest('hex');
}

// ─── OTEL Resource Attributes (匹配 CLI 的 detectResources) ───

function buildEnvBlock(hostId) {
  return {
    platform: 'linux',
    node_version: FAKE_NODE_VERSION,
    terminal: hostId.terminal,
    package_managers: 'npm',
    runtimes: 'node',
    is_running_with_bun: false,
    is_ci: false,
    is_claubbit: false,
    is_github_action: false,
    is_claude_code_action: false,
    is_claude_ai_auth: false,
    version: CLI_VERSION,
    arch: hostId.arch,
    is_claude_code_remote: false,
    deployment_environment: 'unknown-linux',
    is_conductor: false,
    version_base: CLI_VERSION,
    build_time: BUILD_TIME,
    is_local_agent_mode: false,
    vcs: 'git',
    platform_raw: 'linux',
  };
}

function buildProcessMetrics(uptime) {
  // 模拟真实 CLI 的内存曲线：RSS 随 uptime 缓慢增长
  const baseRss = 180_000_000 + Math.min(uptime * 50_000, 200_000_000);
  const rss = Math.floor(baseRss + Math.random() * 80_000_000);
  const heapTotal = Math.floor(rss * 0.6 + Math.random() * 10_000_000);
  const heapUsed = Math.floor(heapTotal * 0.5 + Math.random() * heapTotal * 0.3);
  return Buffer.from(JSON.stringify({
    uptime,
    rss,
    heapTotal,
    heapUsed,
    external: 14_000_000 + Math.floor(Math.random() * 2_000_000),
    arrayBuffers: Math.floor(Math.random() * 10_000),
    constrainedMemory: 0,
    cpuUsage: {
      user: Math.floor(uptime * 10_000 + Math.random() * 300_000),
      system: Math.floor(uptime * 2_000 + Math.random() * 80_000),
    },
    cpuPercent: Math.random() * 200,
  })).toString('base64');
}

function buildEvent(eventName, session, model, betas, extraData, timestampOverride) {
  const uptime = (Date.now() - session.startTime) / 1000;
  const processMetrics = buildProcessMetrics(uptime);
  // 缓存最近一次的 process metrics，供 DataDog 日志复用（保持两边一致）
  session._lastProcessMetrics = { uptime, raw: processMetrics };
  const eventData = {
    event_name: eventName,
    client_timestamp: timestampOverride || new Date().toISOString(),
    model: model || 'claude-sonnet-4-6',
    session_id: session.sessionId,
    user_type: 'external',
    betas: betas || 'claude-code-20250219,interleaved-thinking-2025-05-14',
    env: buildEnvBlock(session.hostId),
    entrypoint: 'cli',
    is_interactive: true,
    client_type: 'cli',
    process: processMetrics,
    event_id: crypto.randomUUID(),
    device_id: session.deviceId,
    // 注意：不加 resource 字段 — event_logging/batch 是自定义端点，
    // OTEL resource attributes 由 CLI 通过单独的 OTLP exporter 发送，不在这里
  };
  // 合并额外字段（用于特定事件的附加数据）
  if (extraData) Object.assign(eventData, extraData);
  return {
    event_type: 'ClaudeCodeInternalEvent',
    event_data: eventData,
  };
}

// 发送遥测到 api.anthropic.com/api/event_logging/batch
function sendTelemetryEvents(events, session) {
  if (!TELEMETRY_ENABLED || events.length === 0) return;

  const body = JSON.stringify({ events });
  const headers = {
    'Accept': 'application/json, text/plain, */*',
    'Content-Type': 'application/json',
    'User-Agent': `claude-code/${CLI_VERSION}`,
    'x-service-name': 'claude-code',
    'Content-Length': Buffer.byteLength(body),
  };
  // 如果有 session，注入 OTEL trace headers（匹配 CLI 的 W3C Trace Context）
  if (session) {
    const traceId = crypto.randomBytes(16).toString('hex');
    const spanId = crypto.randomBytes(8).toString('hex');
    headers['traceparent'] = `00-${traceId}-${spanId}-01`;
  }

  const opts = {
    hostname: 'api.anthropic.com',
    port: 443,
    path: '/api/event_logging/batch',
    method: 'POST',
    headers,
    timeout: 10000,
  };

  const req = https.request(opts, (res) => {
    res.resume(); // drain
    log('debug', 'telemetry_sent', { status: res.statusCode, events: events.length });
  });
  req.on('error', (err) => {
    log('debug', 'telemetry_error', { error: err.message });
  });
  req.on('timeout', () => req.destroy());
  req.end(body);
}

// 发送 DataDog 日志
function sendDatadogLog(eventName, session, model) {
  if (!TELEMETRY_ENABLED) return;

  const hostId = session.hostId;
  const uptime = (Date.now() - session.startTime) / 1000;

  // 复用 Anthropic 事件侧缓存的 process metrics（保持两边数值一致）
  // 如果没有缓存（首次调用），现场生成
  let pm;
  if (session._lastProcessMetrics && Math.abs(session._lastProcessMetrics.uptime - uptime) < 2) {
    pm = JSON.parse(Buffer.from(session._lastProcessMetrics.raw, 'base64').toString());
  } else {
    const baseRss = 180_000_000 + Math.min(uptime * 50_000, 200_000_000);
    const rss = Math.floor(baseRss + Math.random() * 80_000_000);
    const heapTotal = Math.floor(rss * 0.6 + Math.random() * 10_000_000);
    const heapUsed = Math.floor(heapTotal * 0.5 + Math.random() * heapTotal * 0.3);
    pm = {
      uptime,
      rss,
      heapTotal,
      heapUsed,
      external: 14_000_000 + Math.floor(Math.random() * 2_000_000),
      arrayBuffers: Math.floor(Math.random() * 10_000),
      constrainedMemory: 0,
      cpuUsage: {
        user: Math.floor(uptime * 10_000 + Math.random() * 300_000),
        system: Math.floor(uptime * 2_000 + Math.random() * 80_000),
      },
    };
  }

  const entry = {
    ddsource: 'nodejs',
    ddtags: `event:${eventName},arch:${hostId.arch},client_type:cli,model:${model || 'claude-sonnet-4-6'},platform:linux,user_type:external,version:${CLI_VERSION},version_base:${CLI_VERSION}`,
    message: eventName,
    service: 'claude-code',
    hostname: hostId.hostname,
    env: 'external',
    model: model || 'claude-sonnet-4-6',
    session_id: session.sessionId,
    user_type: 'external',
    entrypoint: 'cli',
    is_interactive: 'true',
    client_type: 'cli',
    process_metrics: pm,
    platform: 'linux',
    platform_raw: 'linux',
    arch: hostId.arch,
    node_version: FAKE_NODE_VERSION,
    version: CLI_VERSION,
    version_base: CLI_VERSION,
    build_time: BUILD_TIME,
    deployment_environment: 'unknown-linux',
    vcs: 'git',
  };

  const body = JSON.stringify([entry]);
  const opts = {
    hostname: 'http-intake.logs.us5.datadoghq.com',
    port: 443,
    path: '/api/v2/logs',
    method: 'POST',
    headers: {
      'Accept': 'application/json, text/plain, */*',
      'Content-Type': 'application/json',
      'User-Agent': 'axios/1.13.6',
      'dd-api-key': DD_API_KEY,
      'Content-Length': Buffer.byteLength(body),
    },
    timeout: 10000,
  };

  const req = https.request(opts, (res) => { res.resume(); });
  req.on('error', () => {});
  req.on('timeout', () => req.destroy());
  req.end(body);
}

// 请求前发遥测（模拟 CLI 启动 + 初始化事件）
function emitPreRequestTelemetry(reqHeaders, body) {
  const accountSeed = reqHeaders['x-forwarded-host'] || 'default';
  const deviceId = generateDeviceId(accountSeed + ':' + (reqHeaders['authorization'] || '').slice(-16));
  const session = getOrCreateSession(deviceId);
  session.requestCount++;

  // 从请求体解析真实 model
  let model = 'claude-sonnet-4-6';
  try {
    const parsed = JSON.parse(body.toString());
    if (parsed.model) model = parsed.model;
  } catch (_) {}

  const betas = reqHeaders['anthropic-beta'] || 'claude-code-20250219,context-1m-2025-08-07,interleaved-thinking-2025-05-14,redact-thinking-2026-02-12,context-management-2025-06-27,prompt-caching-scope-2026-01-05,effort-2025-11-24';

  // 首次请求：发完整启动事件序列（匹配真实 CLI 的时序）
  if (session.requestCount === 1) {
    const hostId = session.hostId;
    // 生成递增的时间戳，模拟真实 CLI 启动流程的时间差
    const baseTime = Date.now();
    const ts = (offsetMs) => new Date(baseTime + offsetMs).toISOString();

    // 第一批：启动 + 工具检测 + MCP 连接事件
    const batch1 = [
      buildEvent('tengu_started', session, model, betas, null, ts(0)),
      buildEvent('tengu_init', session, model, betas, null, ts(80 + Math.floor(Math.random() * 120))),
      // tengu_ripgrep_availability — CLI 必发的工具检测事件，版本/路径按账号不同
      buildEvent('tengu_ripgrep_availability', session, model, betas, {
        ripgrep_available: true,
        ripgrep_version: hostId.ripgrepVersion,
        ripgrep_path: hostId.ripgrepPath,
      }, ts(200 + Math.floor(Math.random() * 150))),
    ];
    // MCP 连接事件：数量按账号不同（真实用户配置的 MCP server 数量差异很大）
    let mcpOffset = 400;
    const mcpSuccessCount = hostId.mcpServerCount - hostId.mcpFailCount;
    for (let i = 0; i < hostId.mcpFailCount; i++) {
      mcpOffset += 100 + Math.floor(Math.random() * 300);
      batch1.push(buildEvent('tengu_mcp_server_connection_failed', session, model, betas, null, ts(mcpOffset)));
    }
    for (let i = 0; i < mcpSuccessCount; i++) {
      mcpOffset += 200 + Math.floor(Math.random() * 500);
      batch1.push(buildEvent('tengu_mcp_server_connection_succeeded', session, model, betas, null, ts(mcpOffset)));
    }

    session.ripgrepReported = true;
    sendTelemetryEvents(batch1, session);
    sendDatadogLog('tengu_started', session, model);
    sendDatadogLog('tengu_init', session, model);

    // 第二批延迟发送（真实 CLI 间隔约 30 秒）
    setTimeout(() => {
      const batch2 = [
        buildEvent('tengu_session_init', session, model, betas),
        buildEvent('tengu_context_loaded', session, model, betas),
      ];
      sendTelemetryEvents(batch2, session);
    }, 25000 + Math.floor(Math.random() * 10000));
  }

  // 每次请求：发 request_started
  const events = [
    buildEvent('tengu_api_request_started', session, model, betas),
  ];
  sendTelemetryEvents(events, session);
}

// 请求后发遥测
function emitPostRequestTelemetry(reqHeaders, statusCode, body) {
  const accountSeed = reqHeaders['x-forwarded-host'] || 'default';
  const deviceId = generateDeviceId(accountSeed + ':' + (reqHeaders['authorization'] || '').slice(-16));
  const session = getOrCreateSession(deviceId);

  let model = 'claude-sonnet-4-6';
  try {
    const parsed = JSON.parse(body.toString());
    if (parsed.model) model = parsed.model;
  } catch (_) {}

  const betas = reqHeaders['anthropic-beta'] || 'claude-code-20250219,context-1m-2025-08-07,interleaved-thinking-2025-05-14,redact-thinking-2026-02-12,context-management-2025-06-27,prompt-caching-scope-2026-01-05,effort-2025-11-24';

  // 请求完成事件
  const events = [
    buildEvent('tengu_api_request_completed', session, model, betas),
    buildEvent('tengu_conversation_turn_completed', session, model, betas),
  ];
  sendTelemetryEvents(events, session);
  sendDatadogLog('tengu_api_request_completed', session, model);

  // 模拟错误遥测（低概率，匹配 TelemetrySafeError）
  if (statusCode >= 400 && Math.random() < 0.5) {
    const errorEvent = buildEvent('tengu_api_request_error', session, model, betas, {
      error_type: 'TelemetrySafeError',
      error_code: statusCode,
      error_message: statusCode === 429 ? 'rate_limit_exceeded' :
                     statusCode === 529 ? 'overloaded' :
                     statusCode >= 500 ? 'server_error' : 'client_error',
    });
    sendTelemetryEvents([errorEvent], session);
  }

  // 随机发额外事件（仅使用已知的真实 CLI 事件名）
  if (Math.random() < 0.3) {
    setTimeout(() => {
      const extra = [
        buildEvent('tengu_tool_use_completed', session, model, betas),
      ];
      sendTelemetryEvents(extra, session);
    }, 2000 + Math.floor(Math.random() * 5000));
  }
}

// ─── H2 session 管理 ────────────────────────────────────
function getOrCreateH2Session(host) {
  const existing = h2Sessions.get(host);
  if (existing && !existing.closed && !existing.destroyed) return existing;
  if (existing) { try { existing.close(); } catch (_) {} }

  const session = http2.connect(`https://${host}`);
  session.on('error', (err) => {
    log('warn', 'h2_session_error', { host, error: err.message });
    h2Sessions.delete(host);
    try { session.close(); } catch (_) {}
  });
  session.on('close', () => h2Sessions.delete(host));
  session.on('goaway', () => { h2Sessions.delete(host); try { session.close(); } catch (_) {} });
  session.setTimeout(IDLE_TIMEOUT, () => { session.close(); h2Sessions.delete(host); });
  h2Sessions.set(host, session);
  return session;
}

function waitForConnect(session) {
  if (session.connected) return Promise.resolve();
  return new Promise((resolve, reject) => {
    session.once('connect', resolve);
    session.once('error', reject);
    const t = setTimeout(() => reject(new Error('h2 connect timeout')), CONNECT_TIMEOUT);
    session.once('connect', () => clearTimeout(t));
  });
}

// ─── CONNECT 隧道 ────────────────────────────────────────
function connectViaProxy(proxyUrl, targetHost, targetPort) {
  return new Promise((resolve, reject) => {
    const proxy = new URL(proxyUrl);
    const conn = net.connect(parseInt(proxy.port || '80', 10), proxy.hostname, () => {
      const auth = proxy.username
        ? `Proxy-Authorization: Basic ${Buffer.from(`${decodeURIComponent(proxy.username)}:${decodeURIComponent(proxy.password || '')}`).toString('base64')}\r\n`
        : '';
      conn.write(`CONNECT ${targetHost}:${targetPort} HTTP/1.1\r\nHost: ${targetHost}:${targetPort}\r\n${auth}\r\n`);
    });
    conn.once('error', reject);
    conn.setTimeout(CONNECT_TIMEOUT, () => conn.destroy(new Error('CONNECT timeout')));
    let buf = '';
    conn.on('data', function onData(chunk) {
      buf += chunk.toString();
      const idx = buf.indexOf('\r\n\r\n');
      if (idx === -1) return;
      conn.removeListener('data', onData);
      const code = parseInt(buf.split(' ')[1], 10);
      if (code === 200) { conn.setTimeout(0); resolve(conn); }
      else { conn.destroy(); reject(new Error(`CONNECT ${code}`)); }
    });
  });
}

// ─── 收集请求体 ──────────────────────────────────────────
function collectBody(req) {
  return new Promise((resolve) => {
    const chunks = [];
    req.on('data', (c) => chunks.push(c));
    req.on('end', () => resolve(Buffer.concat(chunks)));
    req.on('error', () => resolve(Buffer.concat(chunks)));
  });
}

// ─── H1 代理 ─────────────────────────────────────────────
function sendViaH1(targetHost, method, path, reqHeaders, body, res, savedHeaders) {
  return new Promise((resolve) => {
    const headers = { ...reqHeaders, host: targetHost };
    ['x-forwarded-host', 'connection', 'keep-alive', 'proxy-connection', 'transfer-encoding'].forEach(h => delete headers[h]);
    if (body.length > 0) headers['content-length'] = String(body.length);

    const opts = { hostname: targetHost, port: 443, path, method, headers, servername: targetHost, timeout: CONNECT_TIMEOUT };
    const startTime = Date.now();

    const finish = (requestOpts) => {
      const proxyReq = https.request(requestOpts);
      proxyReq.on('response', (proxyRes) => {
        log('info', 'proxy_response', { host: targetHost, status: proxyRes.statusCode, path, proto: 'h1' });
        const rh = { ...proxyRes.headers };
        delete rh['connection']; delete rh['keep-alive'];
        res.writeHead(proxyRes.statusCode, rh);
        proxyRes.pipe(res, { end: true });
        // 请求完成后发遥测
        if (path.includes('/v1/messages') && savedHeaders) {
          emitPostRequestTelemetry(savedHeaders, proxyRes.statusCode, body);
        }
        resolve('ok');
      });
      proxyReq.on('error', (err) => {
        if (err.message === 'socket hang up' && (Date.now() - startTime) < 2000) {
          log('info', 'h1_rejected_switching_to_h2', { host: targetHost });
          h2Hosts.add(targetHost);
          sendViaH2(targetHost, method, path, reqHeaders, body, res, savedHeaders).then(() => resolve('h2'));
          return;
        }
        log('error', 'h1_error', { error: err.message, host: targetHost, path });
        if (!res.headersSent) { res.writeHead(502); res.end(JSON.stringify({ error: err.message })); }
        resolve('error');
      });
      proxyReq.on('timeout', () => proxyReq.destroy(new Error('timeout')));
      proxyReq.end(body);
    };

    if (UPSTREAM_PROXY) {
      connectViaProxy(UPSTREAM_PROXY, targetHost, 443)
        .then((socket) => { opts.socket = socket; opts.agent = false; finish(opts); })
        .catch((err) => { log('error', 'tunnel_failed', { error: err.message }); if (!res.headersSent) { res.writeHead(502); res.end('tunnel error'); } resolve('error'); });
    } else {
      finish(opts);
    }
  });
}

// ─── H2 代理 ─────────────────────────────────────────────
async function sendViaH2(targetHost, method, path, reqHeaders, body, res, savedHeaders) {
  try {
    const session = getOrCreateH2Session(targetHost);
    await waitForConnect(session);

    const headers = {};
    const skip = new Set(['host','connection','keep-alive','proxy-connection','transfer-encoding','upgrade','x-forwarded-host','http2-settings']);
    for (const [k, v] of Object.entries(reqHeaders)) {
      if (!skip.has(k.toLowerCase())) headers[k] = v;
    }
    headers[':method'] = method;
    headers[':path'] = path;
    headers[':authority'] = targetHost;
    headers[':scheme'] = 'https';
    if (body.length > 0) headers['content-length'] = String(body.length);

    const stream = session.request(headers);
    let responded = false;

    stream.on('response', (h2h) => {
      responded = true;
      const status = h2h[':status'] || 502;
      const rh = {};
      for (const [k, v] of Object.entries(h2h)) { if (!k.startsWith(':')) rh[k] = v; }
      log('info', 'proxy_response', { host: targetHost, status, path, proto: 'h2' });
      res.writeHead(status, rh);
      stream.on('data', (c) => res.write(c));
      stream.on('end', () => res.end());
      if (path.includes('/v1/messages') && savedHeaders) {
        emitPostRequestTelemetry(savedHeaders, status);
      }
    });

    stream.on('error', (err) => {
      if (err.message && err.message.includes('NGHTTP2')) {
        h2Sessions.delete(targetHost);
        try { session.close(); } catch (_) {}
      }
      if (responded) { if (!res.writableEnded) res.end(); return; }
      log('error', 'h2_error', { error: err.message, host: targetHost, path });
      if (!res.headersSent) { res.writeHead(502); res.end(JSON.stringify({ error: err.message })); }
    });

    stream.on('close', () => {
      if (!responded && !res.headersSent) {
        log('warn', 'h2_no_response', { host: targetHost, path });
        res.writeHead(502); res.end('{"error":"h2_no_response"}');
      } else if (!res.writableEnded) { res.end(); }
    });

    stream.setTimeout(CONNECT_TIMEOUT, () => stream.close());
    stream.end(body);
  } catch (err) {
    log('error', 'h2_exception', { error: err.message, host: targetHost });
    h2Sessions.delete(targetHost);
    if (!res.headersSent) { res.writeHead(502); res.end(JSON.stringify({ error: err.message })); }
  }
}

// ─── 请求入口 ─────────────────────────────────────────────
async function proxyRequest(req, res) {
  const targetHost = req.headers['x-forwarded-host'] || UPSTREAM_HOST;
  log('info', 'proxy_request', { host: targetHost, method: req.method, path: req.url });

  // 保存原始 headers 用于遥测
  const savedHeaders = { ...req.headers };

  const body = await collectBody(req);

  // 请求前发遥测（仅 /v1/messages 请求）
  if (req.url.includes('/v1/messages') && TELEMETRY_ENABLED) {
    emitPreRequestTelemetry(savedHeaders, body);
    // 随机延迟 50-200ms 模拟真实 CLI 行为
    await new Promise(r => setTimeout(r, 50 + Math.floor(Math.random() * 150)));
  }

  if (h2Hosts.has(targetHost)) {
    await sendViaH2(targetHost, req.method, req.url, req.headers, body, res, savedHeaders);
  } else {
    await sendViaH1(targetHost, req.method, req.url, req.headers, body, res, savedHeaders);
  }
}

// ─── HTTP 服务器 ─────────────────────────────────────────
const server = http.createServer((req, res) => {
  if (req.url === HEALTH_PATH) {
    res.writeHead(200, { 'content-type': 'application/json' });
    res.end(JSON.stringify({
      status: 'ok', node: process.version, openssl: process.versions.openssl,
      uptime: process.uptime(), h2Hosts: [...h2Hosts],
      telemetry: TELEMETRY_ENABLED, sessions: sessionStates.size,
    }));
    return;
  }
  proxyRequest(req, res).catch((err) => {
    log('error', 'unhandled', { error: err.message });
    if (!res.headersSent) { res.writeHead(500); res.end('internal error'); }
  });
});

server.timeout = 0;
server.keepAliveTimeout = IDLE_TIMEOUT;
server.headersTimeout = 60000;
server.listen(LISTEN_PORT, LISTEN_HOST, () => {
  log('info', 'node-tls-proxy started', {
    listen: `${LISTEN_HOST}:${LISTEN_PORT}`, node: process.version, openssl: process.versions.openssl,
    telemetry: TELEMETRY_ENABLED,
  });
});

// 定期清理过期 session（1 小时无活动）
setInterval(() => {
  const now = Date.now();
  for (const [id, state] of sessionStates) {
    if (now - state.startTime > 3600_000) sessionStates.delete(id);
  }
}, 300_000);

let stopping = false;
function shutdown(sig) {
  if (stopping) return; stopping = true;
  for (const s of h2Sessions.values()) try { s.close(); } catch (_) {}
  h2Sessions.clear();
  server.close(() => process.exit(0));
  setTimeout(() => process.exit(1), 5000);
}
process.on('SIGTERM', () => shutdown('SIGTERM'));
process.on('SIGINT', () => shutdown('SIGINT'));
process.on('uncaughtException', (e) => log('error', 'uncaught', { error: e.message }));
process.on('unhandledRejection', (r) => log('error', 'rejection', { error: String(r) }));